WSO2 WSO2 Carbon Abstract OTP Authenticator

• CVE-2025-13591 Medium 5.3 Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery 0.3%
• CVE-2025-13909 Medium 4.3 Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure 0.3%